Flashloan fees are distributed unfairly

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBPair.sol#L420-L456

Vulnerability details

Impact

Flash loan fees are distributed only to the participants of active bin(and protocol). This is unfair. Liquidity providers do not earn when they liquidity is used by flashloan.

Proof of Concept

In LBPair.flashLoan function fees for the loan are distributed only to the pair's active bin. Only liquidity providers of this bin are paid for using their liquidity.

When flash loaner takes a huge loan he uses the liquidity not only of active bin, but some other bins as well. All providers of this liquidity should be compensated.

I understand why this is done. Because if they will calculate all bins that should participate in fees distribution it will take more gas and flash loans will be expensive. However, i just want to point to the fact that such distribution is not correct.

Tools Used

VsCode

Recommended Mitigation Steps

Think about another flash loan fee distribution mechanism. Or distribute such fees only to protocol when the flashloan amount is more then active bin reserves.

[Shungy]

I believe this finding to be valid.

However, I think this report is of informational severity. Because the report have not identified an attack vector unlike the other reports mentioning the potential of value leak out of the protocol by way of stealing fees. Such as my report: #136.

Disclaimer: Reduction of severity of this report would benefit me.

[GalloDaSballo]

Dup of #136

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[c4-judge]

GalloDaSballo marked the issue as not a duplicate

[c4-judge]

GalloDaSballo marked the issue as duplicate of #136